529ad251a2b0fec3171f50a855e1b879802e06f73718e9fe68692d8623089a10

Sharing

Copy URL Twitter E-mail

General

Target
529ad251a2b0fec3171f50a855e1b879802e06f73718e9fe68692d8623089a10
Size 2.5MB
Sample261014-fx1nmsf12x
SHA256 529ad251a2b0fec3171f50a855e1b879802e06f73718e9fe68692d8623089a10
MD5 3097eb1b6be12c92d9519f435f401267
SHA1 7f9d267826bc40bfe408b73568819d4f96de0739
SHA512 aa8fd1616cf12908ea91dcd3224158c230fcbe8c5deb55bdaf6cc8741d0b684ffd27f518801b85d9fe063edfccd218b05e24f56548ec094945d30d794e40a7f1
SSDEEP 49152:ASucKOIwr81mLKtL3RG+bii/Zounn5t9eiHXEeNNyum6fUtOqUDQV6FvqFFLim2G:V6fUDUDQV6FvqFFLim24IcwrvOV06WEm
TLSH
T135C5E990F083AA7AD84F077158FFD72EBB74662097336AC3960404A95FE37D43538A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
529ad251a2b0fec3171f50a855e1b879802e06f73718e9fe68692d8623089a10

File Explorer

529ad251a2b0fec3171f50a855e1b879802e06f73718e9fe68692d8623089a10

.dll 2.5MB

529ad251a2b0fec3171f50a855e1b879802e06f73718e9fe68692d8623089a10

IMPHASH cb20e8fc006430a9489f08ec88618efe
SHA256 529ad251a2b0fec3171f50a855e1b879802e06f73718e9fe68692d8623089a10
MD5 3097eb1b6be12c92d9519f435f401267
SHA1 7f9d267826bc40bfe408b73568819d4f96de0739
SHA512 aa8fd1616cf12908ea91dcd3224158c230fcbe8c5deb55bdaf6cc8741d0b684ffd27f518801b85d9fe063edfccd218b05e24f56548ec094945d30d794e40a7f1
SSDEEP 49152:ASucKOIwr81mLKtL3RG+bii/Zounn5t9eiHXEeNNyum6fUtOqUDQV6FvqFFLim2G:V6fUDUDQV6FvqFFLim24IcwrvOV06WEm
TLSH
T135C5E990F083AA7AD84F077158FFD72EBB74662097336AC3960404A95FE37D43538A66
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

999568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

urlmon

AsyncInstallDistributionUnit CoInternetCombineUrlEx CoInternetCreateSecurityManager CoInternetParseIUri CoInternetParseUrl CreateAsyncBindCtx CreateIUriBuilder CreateURLMoniker CreateURLMonikerEx2 CreateUri FindMimeFromData ord445 RegisterBindStatusCallback ReleaseBindInfo

shlwapi

AssocQueryStringW DelayLoadFailureHook ord329 PathCanonicalizeW UrlUnescapeW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW ShellExecuteW

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetClassObject CoTaskMemAlloc CoTaskMemFree CreateBindCtx CreateOleAdviseHolder ProgIDFromCLSID

oleaut32

DispCallFunc LoadRegTypeLib LoadTypeLibEx SafeArrayAccessData SafeArrayCreate SafeArrayDestroy SafeArrayPutElement SafeArrayUnaccessData SysAllocString SysAllocStringLen SysFreeString SysStringLen VarBstrFromI4 VarBstrFromR4 VarBstrFromR8 VarI4FromStr VariantChangeType VariantChangeTypeEx VariantClear VariantCopy VariantInit

user32

BeginPaint CallWindowProcW CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DialogBoxParamW DrawEdge EndDialog EndPaint GetClientRect GetDC GetDesktopWindow GetDlgItem GetFocus GetParent GetPropW GetSubMenu GetSystemMetrics GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect IsWindowVisible KillTimer LoadMenuW LoadStringW MapWindowPoints MessageBoxW PostMessageW RedrawWindow RegisterClassExW ReleaseDC SendMessageW SetFocus SetParent SetPropW SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfW

gdi32

GetDeviceCaps

advapi32

RegCloseKey RegEnumKeyW RegGetValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExA RegQueryValueExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _stricmp _strlwr _strnicmp _wcsdup _wcsicmp _wcslwr _wcsnicmp _wgetenv bsearch calloc floor free fwrite getenv iswalnum iswspace malloc memcmp memcpy memmove memset qsort realloc strchr strcmp strcpy strcspn strlen strncmp wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcsstr wcstol wcstoul

kernel32

CloseHandle CompareStringW CreateDirectoryW CreateFileW CreateMutexW CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection EnumResourceNamesW FindResourceW FreeLibrary GetACP GetDateFormatW GetEnvironmentVariableW GetFileAttributesW GetFinalPathNameByHandleW GetLocalTime GetModuleFileNameW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetSystemTimeAsFileTime GetTickCount GetUserDefaultLCID GetUserDefaultUILanguage GlobalAlloc GlobalFree HeapAlloc HeapFree HeapReAlloc InitOnceExecuteOnce IsBadStringPtrA IsBadStringPtrW LCIDToLocaleName LeaveCriticalSection LoadLibraryExW LoadLibraryW LoadResource MultiByteToWideChar RaiseException ReadFile ReleaseMutex ResolveDelayLoadedAPI SearchPathW SetEnvironmentVariableW SizeofResource TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForSingleObject WideCharToMultiByte WriteFile lstrcmpiW

ntdll

_chkstk _vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

529ad251a2b0fec3171f50a855e1b879802e06f73718e9fe68692d8623089a10

urlmon

shlwapi

shell32

ole32

oleaut32

user32

gdi32

advapi32

ucrtbase

kernel32

ntdll

generic